Thanks, this works. I put the users directory in /var/lib/oath/users.oath. I did not dig too deep, but using
sudo semanage fcontext -a -t systemd_passwd_var_run_t ‘/var/lib/oath(/.*)?’
and
sudo restorecon -rv ‘/var/lib/oath’
lets me use it with SELinux enforcing on

About the author

I am Richard W.M. Jones, a computer programmer. I have strong opinions on how we write software, about Reason and the scientific method. Consequently I am an atheist [To nutcases: Please stop emailing me about this, I'm not interested in your views on it] By day I work for Red Hat on all things to do with virtualization.

My motto is "often wrong". I don't mind being wrong (I'm often wrong), and I don't mind changing my mind.

This blog is not affiliated or endorsed by Red Hat and all views are entirely my own.